@flexmr/survey-client@2.0.12
Generated package
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe source confirms an automatic install-hook disclosure of identifying host information to a fixed collector. This supports blocking publication as install-hook abuse.
Static reason
No blocking static signals were detected.
Trigger
Installing the package and its declared dependency through npm.
Impact
The collector receives identifying information about the installer and environment.
Mechanism
The dependency's preinstall command sends the current user name, hostname, and working directory to a fixed collector without an affirmative consent check.
Attack narrative
Installing the declared dependency activates its preinstall command, which sends the installer's user name, hostname, and working directory to a fixed collector. Both inspected npm platform snapshots contain this behavior, with no affirmative consent gate.
AI rationale
The source confirms an automatic install-hook disclosure of identifying host information to a fixed collector. This supports blocking publication as install-hook abuse.
Evidence
package.jsonindex.js.lpm-dependency-evidence-ff165f14-e70f-4f42-96f0-34273b4d3c44/0/npm-linux/package.json.lpm-dependency-evidence-ff165f14-e70f-4f42-96f0-34273b4d3c44/0/npm-darwin/package.json
Network endpoints2
artifacts.creditslib.com/npm/marker-index-symbol-schemaartifacts.creditslib.com/api/pings
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package declares the remote dependency and its entrypoint re-exports it.
- Both inspected npm dependency manifests run a preinstall request that sends the user name, hostname, and working directory to a collector without a consent guard.
- The Linux and Darwin npm snapshots use different event identifiers but the same collection behavior.
Evidence against
Behavioral surface
Trivial
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
13"marker-index-symbol-schema": "https://artifacts.creditslib.com/npm/marker-index-symbol-schema"
}
High
Suspicious Dependency Evidence
The package declares the remote dependency and its entrypoint re-exports it.
package.jsonView on unpkg · L13index.jsView file
1module.exports = require('marker-index-symbol-schema');
High
Suspicious Dependency Evidence
The package declares the remote dependency and its entrypoint re-exports it.
index.jsView on unpkg · L1.lpm-dependency-evidence-ff165f14-e70f-4f42-96f0-34273b4d3c44/0/npm-linux/package.jsonView file
Findings
4 High
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidenceindex.js
HighSuspicious Dependency Evidence.lpm-dependency-evidence-ff165f14-e70f-4f42-96f0-34273b4d3c44/0/npm-linux/package.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-ff165f14-e70f-4f42-96f0-34273b4d3c44/0/npm-darwin/package.json
Affected versions and remediation
This report applies to @flexmr/survey-client@2.0.12.
See all versions of @flexmr/survey-client for other recorded verdicts.
- Avoid installing @flexmr/survey-client@2.0.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.